Blog: minimizing dependencies#158
Conversation
| of the Bitcoin network's resiliency. But Bitcoin Core's code is not the only | ||
| code executed when running Bitcoin Core. Over the years, Bitcoin Core has also | ||
| relied on external, third-party code and libraries. Some of these dependencies | ||
| have been the source of historical vulnerabilities, and all of them carry |
There was a problem hiding this comment.
source of historical vulnerabilities
Could link to https://bitcoincore.org/en/2024/07/31/disclose-upnp-oom/ or https://bitcoincore.org/en/2024/07/03/disclose_upnp_rce/.
| - Early versions of Core depended on large portions of Boost (filesystem, | ||
| signals, threads). | ||
| - Over the years, these were replaced with C++ standard library equivalents. | ||
| - Today, Boost is header-only and minimal, with plans to remove it entirely. |
There was a problem hiding this comment.
is header-only
Could link to bitcoin/bitcoin#24301.
| vulnerabilities (e.g. Heartbleed) were dangerous. | ||
| - Replaced by [libsecp256k1][], a purpose-built library, developed by Bitcoin | ||
| Core contributors. | ||
| - [Bitcoin Core #6954][bc 6954] (2016). |
There was a problem hiding this comment.
changed 2016 to v0.12.0
| a minimal in-tree NAT implementation. | ||
|
|
||
| - **Boost** | ||
| - Early versions of Core depended on large portions of Boost (filesystem, |
| cross-platform builds with pinned toolchains. | ||
| - [Bitcoin Core #21145][bc 21145]. | ||
|
|
||
| - **macOS Packaging Dependencies** |
There was a problem hiding this comment.
I think we could split this in two:
-
The migration from cctools-port + libtapi + ld64 -> llvm binutils + lld: build: LLD based macOS toolchain bitcoin/bitcoin#21778
-
Other macOS packaging cleanups. Removing
libdmg-hfsplus(build: don't compress macOS DMG bitcoin/bitcoin#24031), migrating to shipping a zip (build: Produce a.zipfor macOS distribution bitcoin/bitcoin#28432, replacedxorrisowithzip), removingnative_biplist(build: remove native_biplist dependency bitcoin/bitcoin#20333), using a static tiff (build: use a static .tiff for macOS .dmg rather than generating bitcoin/bitcoin#23909, droppedlibrsvg,font-tuffy,tiffutilplus others).
There was a problem hiding this comment.
Took a crack are reworking this section
|
|
||
| - **macOS Packaging Dependencies** | ||
| - Legacy tools like cctools, libdmg-hfsplus, mac_alias, and .DS_Store | ||
| metadata hacks were removed during the transition to Guix. |
There was a problem hiding this comment.
Note that none of these changes were really related to Guix.
There was a problem hiding this comment.
Removed that part
80d8a5f to
f47ebe1
Compare
f47ebe1 to
3515dea
Compare
No description provided.